Privacy policy
Last updated Nov 8, 2026
PICKFITS is operated by AshSurge. This page explains what we collect on PICKFITS, why, and what you can ask us to do with it.
1. What we collect
Creators: email, password (stored only as a hash), profile details, social accounts and follower counts, application screenshots, PayPal email and payout history, and a shipping address if you request samples.
Visitors: when you open a creator's link we record the time, referring page, browser type, approximate country and a one-day hashed version of your IP address. We do not store your raw IP.
Reports: your email, what you reported and any image you attach.
2. Why
To attribute orders to the right creator (the link code is kept on ashsurge.com for 30 days), calculate and pay commission, review applications and reports, prevent fraud, and contact you about your account.
3. Cookies and local storage
We use a sign-in cookie for creators and a language cookie. Your wishlist is stored only in your browser and never sent to us. AshSurge's store keeps the creator code with your cart so the order can be credited.
4. Who we share it with
Shopify (which runs ashsurge.com checkout), PayPal (payouts), and our email provider. Customers' names, addresses and payment details are never shown to creators; creators see order numbers, items and amounts only. We don't sell personal data.
5. How long we keep it
Click records: 13 months. Payout and commission records: as long as tax law requires (up to 7 years). Rejected applications and closed reports: 12 months. Accounts you close: deleted within 30 days except records we must keep.
6. Your choices
You can ask to see, correct or delete your data, or object to how we use it, by emailing hello@ashsurge.com. We reply within 30 days. This applies under the GDPR, Japan's APPI and similar laws.